Privacy & Security Information

FOR R2T4 ON THE WEB

Thank you for visiting FAFSA on the Web where our Return of Title IV Funds on
the Web (R2T4 on the Web) is located and for reviewing our privacy policy. Our
policy is simple: We collect no personal information about you unless the
Financial Aid Administrator (FAA) at your school chooses to provide your
personal information to us to determine the amount of Title IV funds that you
have earned (or should have earned) for the period of time you were enrolled.
We do not give, share, sell, or transfer any personal information to a third
party except as permitted under the Privacy Act as a "routine use."

If you want to know more about how we record non-personal
information about your visit or how we use information that your FAA
voluntarily submits, read on.

1. What is R2T4 on the Web?

Return of Title IV Funds on the Web (R2T4 on the Web) is a product of Federal Student Aid (FSA)
of the U.S. Department of Education (ED). R2T4 on the Web is used by FAAs
to calculate the earned and unearned portions of Title IV student
aid when a student withdraws from a postsecondary institution
before completing the period for which the student was paid. An FAA
may also use this Web site to track required notifications to the
Title IV recipient and to track the recipient’s responses.

R2T4 on the Web is a Web-based system that allows participating institutions to
perform required calculations and to track required notifications
consistent with the federal regulations implementing Section 484B of
the Higher Education Act of 1965, as amended (HEA) by the Higher
Education Amendments of 1998 (P.L. 105-244, enacted October 7, 1998)
for the treatment of Title IV HEA program funds when a student
withdraws from an institution.

FAAs utilize the functions of R2T4 on the Web through a Web site called FAA
Access to CPS Online. This Web site enables FAAs to exchange financial
aid information with ED for students who have released FAFSA data to a
particular school, for the purpose of awarding financial aid or
correcting information provided to obtain financial aid.

The statute requires that if a recipient of Title IV grant or loan
funds withdraws from an institution after beginning attendance, the
school must determine the amount of Title IV HEA program assistance
that is earned by the student. If the amount disbursed to the student
is greater than the amount the student earned, unearned funds have to
be returned to the Title IV programs. If the amount the student was
disbursed is less than the amount the student earned, the school must
make available to the otherwise eligible recipient the amount of Title
IV funds that could have been disbursed as a post-withdrawal
disbursement.

ED simply stores and maintains the school-entered data in the R2T4 on the Web
database in which schools calculate the return of Title IV funds and
track the notification and response process.

2. What information is being collected in R2T4
on the Web and how is it used?

FAAs who choose to use R2T4 on the Web must first register with ED and receive
an FSA User ID and password. Registrants must provide
specific personal and school identifiers that are authenticated by ED
before creating an R2T4 record for you or gaining access to your record
later.

To create a record and calculate the types and amounts of Title IV aid
that you and the school must return to Title IV programs, your FAA must
provide data about you.

A. Demographic and Withdrawal Information

The demographic information your FAA provides will enable him or
her to create an R2T4 record for you and will identify your file
among all the R2T4 records created by that particular school.
This information includes your Social Security Number (which is
required to create a record), your name, and your date of birth.
Your withdrawal information determines the point at which you
ceased attendance and is used to determine the percentage of the
period you were enrolled. The amount of Title IV program
assistance that you have earned is based upon the percentage of
time that you completed at your school. Your withdrawal
information includes: the withdrawal date, the date the institution
determined you withdrew (as reported by the institution), and a
description of the type of withdrawal.

B. Program of Study Information

Your FAA must add information about your school and the
educational program in which you were enrolled before withdrawing,
to identify your school’s program type in order to perform the
correct R2T4 calculation. This information includes your federal
school code, award year, grade level, program type (i.e., credit
hour or clock hour), program title, and whether an outside entity
requires your school to take attendance.

C. Payment Period or Period of Enrollment Information

The R2T4 calculation is based on the amount of time you completed
divided by the total amount of time that was scheduled to be in
your payment period or period of enrollment. Schools that
measure student enrollment in standard term-based periods
(semesters, trimesters, or quarters) must perform the calculation
of earned vs. unearned Title IV aid on the basis of a payment
period. Schools who measure student enrollment in non-term-based
or nonstandard term periods may choose to use either a payment
period or period of enrollment for all students in that program.
Institutions must consistently use either a payment period or
period of enrollment for calculating R2T4 on the Web. The following
information is collected by your FAA: school calendar code (which
maintains the term start and end dates and institutionally
scheduled breaks of 5 or more consecutive days), net number of days
in the payment period or period of enrollment, the number of days
of an approved leave of absence (if you took one), the clock hours
scheduled in the program, the clock hours you completed, whether
the R2T4 calculation is based upon a payment period or period of
enrollment, and the total number of clock hours or number of days
in the payment period or period of enrollment.

D. Institutional Charges Information

Institutional charges (a charge for tuition and fees, room and
board (if charged by the institution), and other
educationally-related costs) are the original amounts the school
charged you to attend. Your FAA will enter a description and the
amount of each institutional charge, the total institutional
charges for your program, and the amount of outstanding charges if
you are eligible for a post-withdrawal disbursement.

E. Financial Aid Received

Your FAA will enter the types and amounts of Title IV aid that
were disbursed (paid toward your institutional charges or to you
after all your charges were paid) and the types and amounts that
“could have been disbursed” (not yet paid out). The
percentage of the payment period or period of enrollment that you
attended is multiplied by the total financial aid that was
disbursed or could have been disbursed to determine the amount
that you are able to retain and the amount that you must return to
the Title IV programs. If the amount of Title IV funds that were
earned is less than the amount that was disbursed, and you are an
otherwise eligible Title IV aid recipient who meets the conditions
for a late disbursement, the school must offer you the difference
as a post-withdrawal disbursement.

F. The R2T4 Calculation

From the information your FAA provides, R2T4 on the Web will calculate the
types and amounts of Title IV aid that must be returned to each
program by you and your school and the types and amounts of aid
that you earned. FAAs can retrieve your information and the dates
of their notifications and your responses from R2T4 on the Web by
generating reports contained within the Web product.

G. Dates Notices Sent and Your Response Dates

R2T4 on the Web maintains the dates your FAA provides to track required
school notifications to you and your responses to those
notifications. Your FAA can enter dates for the following
notifications: the date you provided the school with written
authorization to credit Title IV aid to your account, the date
your school notified you of the amounts and types of Title IV
funds that must be returned, the date you responded and your
response, post-withdrawal disbursement information (i.e., the
dates notices were sent informing you that a credit was applied
and/or that a disbursement was available and the dates of your
responses, the amount and the date you accepted a post-withdrawal
disbursement, and the date the post-withdrawal disbursement was
completed). The software also retains the date the return of Title
IV funds procedure was completed.

H. School Defined Information

Your FAA may add other information to your record for school use.
Some examples include but are not limited to: grade point average,
major in college, overpayment status, withdrawal reason, leave of
absence reason, and contemporaneous notes regarding your
withdrawal process. While the data elements indicated above meet
the definition of an “educational record” and are therefore
protected by the Family Educational Rights and Protection Act
(FERPA), these data are being disclosed to the Department in
connection with the Title IV, HEA financial aid that you have
received and can be shared with the Department without your prior
consent as provided in 34 CFR 99.31(a)(3). These data are
necessary for the determination of compliance and consistent with
§484B of the HEA, as amended.

If your FAA creates or modifies a student’s record, the student
record will be identified with the personal FAA information he or
she entered when the Web site was accessed. This information
includes the FAA’s Social Security Number (the first 5 digits will
not be viewable) and your Federal School Code.

I. Non-Personal Information We Record (Use of Cookies)

No cookies or other tracking technology are used on the Web site.
If your FAA does nothing during his or her visit but browse
through the Web site, read pages, or download information, our Web
site’s operating system will automatically record some general
information about his or her visit.

During your FAA’s visit, our Web operating system will record:

The Internet domain for the FAA’s Internet service, such as
“xcompany.com” or “xcompany.net” if he or
she uses a private Internet access account, or
“yourschool.edu” if he or she connects from a college
or university domain.

The type of browser (such as “Internet Explorer version x”) that he or she is using.

The type of operating system that he or she uses (such as
Macintosh, Unix, or Windows).

The date and time your FAA visited our site, and the Web pages
that he or she visits on our site.

The address of the previous Web site your FAA was visiting, if
he or she linked to us from another Web site.

The user is not identified in the collection of non-personal
information. The user is identified in the collection of personal
information.

3. FSA Authority for the Collection of SSN and
Other Privacy Protected Information for R2T4 on the Web:

4. Rights Under the Privacy Act or Other Applicable Law

A system of record has been created under the Privacy Act, 5
U.S.C. 552a. It was published in the Federal Register at 69 Fed.
Reg. 44521 (July 26, 2004).

The Department of Education may disclose information contained in a
record in an individual’s account under the routine uses listed in
the Privacy Act System of Records notice without the consent of the
individual if the disclosure is compatible with the purposes for
which the record was collected. Specific disclosures include the
following:

To the postsecondary institution that input the information
into the R2T4 system

Freedom of Information Act (FOIA) Advice Disclosure

Disclosure to the Department Of Justice

Contract Disclosure

Litigation and Alternative Dispute Resolution (ADR) Disclosures

Research Disclosure

Congressional Member Disclosure

Disclosure for Use By Law Enforcement Agencies

Enforcement Disclosure

Employment, Benefit, and Contracting Disclosure

Employee Grievance, Complaint or Conduct Disclosure

Labor Organization Disclosure

These disclosures may be made on a case-by-case basis. If the
Department has complied with the computer matching requirements of
the Privacy Act, disclosure also may be made to another agency
under a computer matching agreement.

There will be no sharing of information for purposes outside of the
above disclosure requirements or for anything other than the
primary purpose(s) of collecting the information. Any contractor
responsible for the operations of this Web site is held to the
privacy and security requirements of the Department of Education
in the handling of information collected through the Web site.

As the subject of an account in your name, the Privacy Act affords
you the ability to access your account and the right to request
the amendment of inaccurate information in your record. You may
request the information in your account from the FAA at the school
from which you withdrew. A full explanation of your rights under
the Privacy Act is set forth in the Department’s
Privacy Act regulations.

Each record in this system is indexed and retrieved only by an FAA
of the school from which the student withdrew by a student’s
Social Security Number or last name. Student records are created
and accessed only by an FAA of the school from which the student
withdrew. Accordingly, we maintain the information FAAs provide
in a system of records protected by the Privacy Act and administer
it in accordance with the Act and with the Privacy Act systems of
record notice published at 69 Fed. Reg. 44521 (July 26, 2004).
[http://www.ed.gov/legislation/FedRegister/other/2004-3/072604d.html].
The Department of Education, through R2T4 on the Web, is authorized to
collect and use the information your FAA provides under the
following authorities:

The information maintained in the R2T4 on the Web system is authorized
under §484B of the HEA. Under §484B of the HEA (20 U.S.C. §1091b),
if a recipient of Title IV grant or loan assistance withdraws from
an institution during a payment period or period of enrollment in
which the student began attendance, a participating institution
must determine the amount of grant and loan assistance to be
returned to the Title IV programs.

5. Voluntary Collection of SSN and other
Privacy Protected Information

Providing the information in any case is voluntary on your FAA’s
part. However, if he or she chooses not to use R2T4 on the Web, your FAA
will still be required to calculate the return of Title IV funds
consistent with the Higher Education Act and its implementing
regulations.

6. What if My FAA Chooses Not to Use R2T4
On the Web?

Using R2T4 on the Web is not required, but we encourage FAAs to make use
of this free Web product. The Department endorses R2T4 on the Web as it
effectuates the provisions of 20 U.S.C. 1091b, as implemented in
34 CFR 668.22, for the determination of the earned and unearned
amounts of Title IV, HEA program funds when a student ceases to be
enrolled from an institution prior to the planned completion date.
While FAAs may use other software products to calculate the return
of Title IV funds, he or she is still required to comply with the
HEA and its implementing regulations in their entirety.

7. Security

The Office of Management and Budget (OMB) requires the completion
of a system security plan in Circular A-130, “Management of
Federal Information Resources,” Appendix III, “Security
of Federal Automated Information Resources,” and Public Law
100-235, “Computer Security Act of 1987.” The Web
site’s system security plan demonstrating its compliance with
the IT requirements mandated by federal law and policy was added to
ED’s Central Processing System (CPS) security plan when the
Web product was released. The security plan contains details
regarding the Risk Assessment conducted for the Web site, as well
as the security controls (hardware/software/facilities/personnel)
in place to mitigate any identified risks to the information
collected on the Web site. Management, operational, and technical
security controls are in place for the Web site, encompassing
personnel, physical environment access, contingency plans, disaster
recovery, and identification and authentication procedures. The Web
site is currently in the operations/maintenance phase of the life
cycle. As such, the following functions are being performed: security
operations and administration, operational assurance, audits and
monitoring. The System Security Officer (SSO) for the Web site is
Valerie Hough (Management and Program Analyst) (202) 377-3166.

INTRODUCTION TO PRIVACY IMPACT ASSESSMENT

Section 208 of the E-Government Act of 2002 (P.L.107-347) requires
FSA to complete a Privacy Impact Assessment for each new system
that collects information from the public through the Internet.

During the Definition Phase of the FSA Solution Lifecycle, the
System Security Officer must make sure that the team completes the
attached Privacy Impact Assessment Questionnaire, must have it
reviewed by the Chief Information Officer or equivalent official,
and must file the completed form in the system’s Security Notebook
as part of the system’s documentation. This Privacy Impact
Assessment must also be made publicly available.

Privacy Impact Assessment Questionnaire

System Name: Return To Title IV Funds on the Web (R2T4 on the Web)
System Owner: William Leith
Privacy Impact Assessment Questionnaire Author: Marya Dennis
Date: September 12, 2004

Officials and organizational components involved in the analysis
and review of the Privacy Impact Assessment included the following:
Department of Education (ED) Federal Student Aid (FSA), Office of
the Chief Information Officer (CIO), specifically William Leidinger,
John Tressler, and Chiquitta Thomas; FSA CIO, the System Security
Officer (SSO) for R2T4 on the Web, and the Office of
General Counsel (OGC).

1. What information will be collected for the system?

Demographic and Withdrawal Information:

See 2. A. above.

Program of Study Information:

See 2. B. above.

Payment Period or Period of Enrollment Information:

See 2. C. above.

Institutional Charges Information:

See 2. D. above.

Financial Aid Received:

See 2. E. above.

The R2T4 Calculation:

See 2. F. above.

Dates Notices Sent and Your Response Dates:

See 2. G. above.

School Defined Information:

See 2. H. above.

Use of Cookies:

See 2. I. above.

2. Why is this information being collected?

The information collected is necessary for an FAA to calculate
the return of Title IV funds when a student withdraws from a
postsecondary institution before completing the period for which
the student was paid. R2T4 on the Web is provided and maintained by the
U.S. Department of Education.

3. How will FSA use this information?

Records in this system will be created and used by an FAA of
the school from which the student withdrew. FSA will store and
maintain the database. Only under specific circumstances will
the information collected in this system of records be used by
FSA. See 4. above for more information.

4. Will this information be shared with any other agency or
entity? If so, with which agency or agencies/entities?

See 4. above.

5. Describe the notice or opportunities for consent that
would be or are provided to individuals about what information
is collected and how that information is shared with other
organizations.

As the Web site is a government agency Web site that FAAs of
schools access, the Privacy Policy is appropriately posted for
Web site users. This is a general policy, which applies to the
handling of any information collected at the site. The policy
highlights the voluntary nature of information collected, and
explains which data elements are necessary for functionality.
Users are notified that providing the information constitutes
consent to all of its uses and they are given no option to
affirmatively consent to certain limited uses. In addition,
the policy notifies customers about the automatic recording
and potential uses of any non-personal information about a
visit (i.e., site management data).

A Privacy Act Statement is incorporated into the FSA Web
Privacy Policy articulating the specific authority for
collecting personal information that will be maintained and
retrieved by name or identifier from a Privacy Act system of
records, the mandatory or voluntary nature of the information
collected and the uses of the information. A link to the
Privacy Act Statement is provided on the FAFSA on the Web home page.

6. How will the information be secured?

See 7. above.

7. Is a system of records being created or updated with the
collection of this information?

Yes, a system of records has been created with this collection
of information. Users are provided notice of rights under the
Privacy Act via links to the agency Privacy Act regulations
(5 C.F.R. Part 5b.) and to the Privacy Act system of records
notice for the Web site (69 Fed. Reg. 44521 (July 26, 2004)).

8. List the Web addresses (known or planned) that will have
a Privacy Policy

http://www.fafsa.gov.
Students will find the link to the R2T4 on the Web Privacy Policy
under the Privacy Policy Link on the www.fafsa.gov Web site.